Content Injection Affecting remarkable package, versions <1.4.1


0.0
medium

Snyk CVSS

    Attack Complexity Low

    Threat Intelligence

    Exploit Maturity Mature
    EPSS 0.09% (37th percentile)
Expand this section
NVD
6.1 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID npm:remarkable:20141113
  • published 13 Nov 2014
  • disclosed 13 Nov 2014
  • credit Adam Baldwin

How to fix?

Upgrade remarkable to version 1.4.1 or higher.

Overview

remarkable is a markdown parsing library written in Javascript.

Affected versions of this package are vulnerable to Content Injection. Certain input when passed into remarkable will bypass the bad prototcol check that disallows the javascript: scheme allowing for javascript: url's to be injected into the rendered content.

Details

Example:

[link](<javascript:alert(1)>)

This will be turned into <a href="javascript:alert(1)">link</a>

where as

[link](javascript:alert(1))

Would be rendered as [link](javascript:alert(1)) because it's an invalid scheme.

References